§ 103-f. Cybersecurity awareness training. 1. (a) Employees of the
state who use technology as a part of their official job duties shall
take annual cybersecurity awareness training beginning January first,
two thousand twenty-six. Employees of the state shall be required to
complete the training provided by the office.

(b) For purposes of this section, "employees of the state" shall
include employees of all state agencies and all public benefit
corporations, the heads of which are appointed by the governor.

2. Employees of a county, a city, a town, a village, or a district as
defined in section one hundred nineteen-n of the general municipal law,
who use technology as a part of their official job duties shall take
annual cybersecurity awareness training beginning January first, two
thousand twenty-six. The office shall make a cybersecurity training
available for use by a county, a city, a town, a village, or a district
as defined in section one hundred nineteen-n of the general municipal
law, at no charge, provided however, no employee of a county, a city, a
town, a village, or a district as defined in section one hundred
nineteen-n of the general municipal law shall be required to complete
such training provided by the office and the cybersecurity awareness
training requirements of this section may be satisfied by the completion
of other cybersecurity awareness training.

3. All training mandated by this section shall be conducted during the
employee's regular working hours and employees shall receive
compensation at their regular rate of pay for any time spent
participating in such training.